CVE-2026-77028: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in yootheme.com Zoo extension for Joomla

CVE-2026-77028 is a medium-severity vulnerability affecting the yootheme.com Zoo extension for Joomla. It involves improper neutralization of input during web page generation, specifically a reflected XSS and open redirect via the submission redirect parameter in versions prior to 4.1.66. The CVSS 4.0 base score is 5.3, indicating a moderate impact with network attack vector, low complexity, no privileges required, and user interaction needed. The vulnerability could lead to limited confidentiality, integrity, and availability impacts.

Successful exploitation could allow attackers to execute arbitrary scripts in users' browsers, potentially leading to session hijacking, phishing, or redirection to malicious sites. The open redirect aspect could be used to redirect users to attacker-controlled domains. The overall impact is limited by the need for user interaction and the low severity rating.

A fix is available in Zoo extension version 4.1.66. Users should upgrade to version 4.1.66 or later to remediate this vulnerability. No other mitigation steps are indicated by the vendor advisory.